Detailed Description: Use Lua to compile the Wireshark Dissector plug-in

UseLuaWriteWiresharkOfDissectorIs the content to be introduced in this article,DissectorIt can be used to analyze and display specific protocols. It is useful when analyzing self-implemented application-layer protocols. DissectorPlug-insGenerally, C is used for implementation. For details, referWiresharkSource code in \ epan \ dissectors under the Code directory and the source code under the plugins directory.

Some simple dissector plug-ins that do not have high performance requirements can also be implemented using Lua. Wireshark has embedded support for Lua.

The following is a simple example:

Defines the Protocol. trivial filtering can be used in wireshark.

 
 

  
  
trivial_proto = Proto("trivial","TRIVIAL","Trivial Protocol") 
 
 

Dissector Function

 
 

  
  
function trivial_proto.dissector(buffer,pinfo,tree) 
 
 

For pinfo members, refer to the user manual.

 
 

  
  
pinfo.cols.protocol = "TRIVIAL" 
  
  
pinfo.cols.info = "TRIVIAL data" 
  
  
local subtree = tree:add(trivial_proto,buffer(),"Trivial Protocol") 
 
 

Does not correspond to any data

 
 

  
  
subtree:add(buffer(0,0),"Message Header: ") 
 
 

The version number corresponds to the first byte.

 
 

  
  
subtree:add(buffer(0,1),"Version: " .. buffer(0,1):uint()) 
 
 

Type corresponds to the second byte

 
 

  
  
type = buffer(1,1):uint()  
  
  
type_str = "Unknown" 
  
  
if type == 1 then  
  
  
    type_str = "REQUEST" 
  
  
elseif type == 2 then  
  
  
    type_str = "RESPONSE" 
  
  
end  
  
  
subtree:add(buffer(1,1), "Type: " .. type_str) 
 
 

Data starting from the third byte

 
 

  
  
    size = buffer:len()  
  
  
    subtree:add(buffer(2,size-2), "Data: ")  
  
  
end  
  
  
tcp_table = DissectorTable.get("tcp.port") 
 
 

Register with tcp port 8888

 
 

  
  
tcp_table:add(8888,trivial_proto) 
 
 

Plug-insAfter writing the script, keep it as the test. lua file. We can capture the package and test it.

Make sure that your Wireshark supports lua. If the directory contains the init. lua file, it indicates that Lua is supported. Next, you need to start the support for Lua. By default, the support for Lua is not started. Edit init. comment out the line "disable_lua = true;" in the lua file, and add a line of dofile ("test. lua "), so that Wireshark will automatically call test at startup. lua. You can also specify the script file to be executed on the command line, for example,Wireshark-X lua_script: test. lua ".

Summary: Usage DetailsLuaWriteWiresharkOfDissectorI hope this article will help you!